Lazarus Group used a fake playable NFT game to steal wallet credentials through a vulnerability on Google Chrome. 

Read more at cointelegraph.com